Analysis
- max time kernel
46s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/10/2022, 00:26
General
- Target 8600ba5fe6af2bb5f70e162bf22e34bf558a2dd9820ba50e2e5e2cdf71c3e5f4.exe
- Size 732KB
- Sample221029-arax5sdeb2
- SHA256 8600ba5fe6af2bb5f70e162bf22e34bf558a2dd9820ba50e2e5e2cdf71c3e5f4
Score
10/10
Malware Config
Signatures
- ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
- ISR Stealer payload 2 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Uses the VBS compiler for execution 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8600ba5fe6af2bb5f70e162bf22e34bf558a2dd9820ba50e2e5e2cdf71c3e5f4.exe"C:\Users\Admin\AppData\Local\Temp\8600ba5fe6af2bb5f70e162bf22e34bf558a2dd9820ba50e2e5e2cdf71c3e5f4.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\dGNZ3IeldH.ini"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
vbc.exe
vbc.exe
vbc.exe
memory/1712-139-0x0000000075340000-0x00000000758F1000-memory.dmp
memory/1712-132-0x0000000075340000-0x00000000758F1000-memory.dmp
memory/2268-147-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2268-146-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2268-143-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2268-148-0x0000000000400000-0x0000000000453000-memory.dmp
memory/3380-140-0x0000000000400000-0x000000000045A000-memory.dmp
memory/3380-134-0x0000000000400000-0x000000000045A000-memory.dmp